Cisco introduces the Antares model family to automate vulnerability identification in source code, offering high-performance analysis at a fraction of current industry costs.
Cisco has released Antares, a collection of compact, open-weight language models engineered to automate the identification of vulnerability locations within complex codebases. The release includes the Antares-350M and Antares-1B variants on Hugging Face, with a larger Antares-3B iteration scheduled for future deployment.
The architecture facilitates local execution, allowing security teams to process sensitive source code on-premises without transmitting data to external cloud providers. This design choice addresses the operational security requirements of universities, public-sector institutions, and smaller research organizations that often face budgetary constraints regarding high-token-count model usage.
Each model employs an agentic search strategy that mimics manual investigative workflows by performing recursive file-system traversals and syntactic pattern matching based on vulnerability descriptions. The system iteratively searches for code patterns, evaluates candidate files, integrates new evidence, and backtracks when necessary to isolate the specific segments requiring remediation.
This methodology produces a ranked list of source files accompanied by the terminal trace that generated the findings, providing a transparent audit path for security analysts. By automating the initial triage phase, the models allow engineers to bypass hours of manual file-by-file inspection in unfamiliar repositories.
Cisco developed the Vulnerability Localization Benchmark to evaluate these models, as existing general-purpose coding benchmarks failed to capture the specific requirements of security-focused reasoning. This new benchmark comprises 500 entries derived from Common Weakness Enumeration categories, providing a standardized environment for assessing how agents identify security flaws.
Performance metrics indicate that the Antares family achieves competitive F1 scores despite its significantly smaller parameter count. The Antares-1B model outperforms larger systems like GLM-5.2 and Gemini 3 Pro in specific localization tasks, while the forthcoming Antares-3B demonstrates performance parity with stronger configurations such as GPT-5.5.
Economic efficiency remains a primary differentiator for the Antares family, which offers substantial reductions in both computational cost and runtime. Evaluations show that the Antares models complete localization tasks at approximately 172 times lower cost than GPT-5.5 and 15.2 times lower cost than GLM-5.2. These efficiency gains enable continuous security scanning on every commit, a capability previously restricted to organizations with substantial infrastructure budgets.
According to Help Net Security, the development of these models stems from earlier Cisco Foundation AI research demonstrating that compact models can learn to effectively search, reflect, and revise strategies without requiring massive parameter counts. This research highlights that useful retrieval behavior emerges from learned search strategies rather than sheer scale, allowing for a more surgical approach to code analysis.
Amin Saberi, a professor of management science and engineering at Stanford University, noted that the expansion of high-end detection capabilities to smaller organizations is essential for modern software security. He observed that security cannot remain a luxury good, and the ability to run near-frontier accuracy models on local hardware allows smaller teams to allocate their limited engineering hours toward remediation rather than manual triage.
The release of Antares complements Cisco’s existing portfolio of security research, including the Foundry Security Spec and the CodeGuard rules corpus. By focusing on modular, agentic search strategies, the company aims to integrate these models into existing application security toolchains that already include software composition analysis and dynamic testing.
The industry must now monitor how these compact models perform when integrated into heterogeneous production environments with varying coding standards. Future milestones include the public release of the Antares-3B weights and potential community contributions to the Vulnerability Localization Benchmark to expand its coverage of diverse software architectures.
